Changeset 51362 for trunk/src/wp-includes/blocks.php

Timestamp:

07/06/2021 11:55:44 PM (3 years ago)

Author:

peterwilsoncc

Message:

Block Editor: Update packages with latest fixes for 5.8 RC2

Includes the following fixes:

• Query Block: Type validation of WP_Query parameters.

Props ntsekouras, stevehenty, peterwilsoncc, desrosj.
Fixes #53397.

File:

• trunk/src/wp-includes/blocks.php (modified) (3 diffs)

trunk/src/wp-includes/blocks.php

@@ -1058 +1058 @@
 
     if ( isset( $block->context['query'] ) ) {
-        if ( isset( $block->context['query']['postType'] ) ) {
-            $query['post_type'] = $block->context['query']['postType'];
+        if ( ! empty( $block->context['query']['postType'] ) ) {
+            $post_type_param = $block->context['query']['postType'];
+            if ( is_post_type_viewable( $post_type_param ) ) {
+                $query['post_type'] = $post_type_param;
+            }
         }
         if ( isset( $block->context['query']['sticky'] ) && ! empty( $block->context['query']['sticky'] ) ) {
@@ -1069 +1072 @@
             }
         }
-        if ( isset( $block->context['query']['exclude'] ) ) {
-            $query['post__not_in'] = array_merge( $query['post__not_in'], $block->context['query']['exclude'] );
-        }
-        if ( isset( $block->context['query']['perPage'] ) ) {
-            $query['offset']         = ( $block->context['query']['perPage'] * ( $page - 1 ) ) + $block->context['query']['offset'];
-            $query['posts_per_page'] = $block->context['query']['perPage'];
-        }
-        if ( isset( $block->context['query']['categoryIds'] ) ) {
-            $query['category__in'] = $block->context['query']['categoryIds'];
-        }
-        if ( isset( $block->context['query']['tagIds'] ) ) {
-            $query['tag__in'] = $block->context['query']['tagIds'];
-        }
-        if ( isset( $block->context['query']['order'] ) ) {
+        if ( ! empty( $block->context['query']['exclude'] ) ) {
+            $excluded_post_ids     = array_map( 'intval', $block->context['query']['exclude'] );
+            $excluded_post_ids     = array_filter( $excluded_post_ids );
+            $query['post__not_in'] = array_merge( $query['post__not_in'], $excluded_post_ids );
+        }
+        if (
+            isset( $block->context['query']['perPage'] ) &&
+            is_numeric( $block->context['query']['perPage'] )
+        ) {
+            $per_page = absint( $block->context['query']['perPage'] );
+            $offset   = 0;
+
+            if (
+                isset( $block->context['query']['offset'] ) &&
+                is_numeric( $block->context['query']['offset'] )
+            ) {
+                $offset = absint( $block->context['query']['offset'] );
+            }
+
+            $query['offset']         = ( $per_page * ( $page - 1 ) ) + $offset;
+            $query['posts_per_page'] = $per_page;
+        }
+        if ( ! empty( $block->context['query']['categoryIds'] ) ) {
+            $term_ids              = array_map( 'intval', $block->context['query']['categoryIds'] );
+            $term_ids              = array_filter( $term_ids );
+            $query['category__in'] = $term_ids;
+        }
+        if ( ! empty( $block->context['query']['tagIds'] ) ) {
+            $term_ids         = array_map( 'intval', $block->context['query']['tagIds'] );
+            $term_ids         = array_filter( $term_ids );
+            $query['tag__in'] = $term_ids;
+        }
+        if (
+            isset( $block->context['query']['order'] ) &&
+                in_array( strtoupper( $block->context['query']['order'] ), array( 'ASC', 'DESC' ), true )
+        ) {
             $query['order'] = strtoupper( $block->context['query']['order'] );
         }
@@ -1088 +1113 @@
             $query['orderby'] = $block->context['query']['orderBy'];
         }
-        if ( isset( $block->context['query']['author'] ) ) {
-            $query['author'] = $block->context['query']['author'];
-        }
-        if ( isset( $block->context['query']['search'] ) ) {
+        if (
+            isset( $block->context['query']['author'] ) &&
+            (int) $block->context['query']['author'] > 0
+        ) {
+            $query['author'] = (int) $block->context['query']['author'];
+        }
+        if ( ! empty( $block->context['query']['search'] ) ) {
             $query['s'] = $block->context['query']['search'];
         }